a3b3fc314599f7efb5f9cdf5f27b5352f9474c28fb5bffad6181c42c2b16d83a

Analysis

max time kernel
1s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 04:53

Target

a3b3fc314599f7efb5f9cdf5f27b5352f9474c28fb5bffad6181c42c2b16d83a.dll
Size

36KB
MD5

b54e397b362c2c30497034cbd4b11659
SHA1

3301c930f447573f20e215bd5bb7c3f2d9959073
SHA256

a3b3fc314599f7efb5f9cdf5f27b5352f9474c28fb5bffad6181c42c2b16d83a
SHA512

1ecefcbc4eee44d799161896cc6b12602613fed169388d47cce0069ca0ae278de9dda4fa17704ed52be315e991ae55777eb143bf16abc94def565bb4b6ecaee6
SSDEEP

768:GG53hJbyNbNON0lQwuXgcR1pV7Oq7Kj95hNDRR0VAZGg:HxByNbN+eqgcRF7V7YvdR0VAkg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28
PID 1704 wrote to memory of 1176	1704	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3b3fc314599f7efb5f9cdf5f27b5352f9474c28fb5bffad6181c42c2b16d83a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3b3fc314599f7efb5f9cdf5f27b5352f9474c28fb5bffad6181c42c2b16d83a.dll,#1
  2⤵
  PID:1176

memory/1176-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download